Preview File Migration

Resolve a whole planned import against the tenant, storing nothing.

An import driver is a one-off script pointed at a directory nobody has read carefully, and its cheapest failure is the one it does not notice: a vendor whose documents all landed nowhere, a folder created under a misspelling beside the real one, ten thousand uploads addressed to the wrong tenant. So the plan is resolved before any bytes move — the manifest is names and ids only — and the answer is per item plus rolled up, since "which document failed" and "is this the import I meant" are different questions.

It carries the same permission gate as POST /files/migrate deliberately, even though it only reads: a credential that can preview an import can run it, so a driver that gets past this call cannot then fail thousands of uploads in on a 403.

The whole manifest arrives at once rather than a page at a time, because the folder rollups are only true when deduplicated across all of it — three hundred documents naming one new folder create one folder, and a paged preview would call it new on every page.

Cost does not scale with the manifest: the vendor, folder and existing-document lookups are four set-based queries (plus a chunk per five hundred distinct filenames) whatever the item count, and everything else is decided in memory.